Control: 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs
CloudTrail is a web service that records AWS API calls for an account and makes those logs available to users and resources in accordance with IAM policies. AWS Key Management Service (AWS KMS) is a managed service that helps create and control the encryption keys used to encrypt account data, and uses hardware security modules (HSMs) to protect the security of encryption keys.
You can configure CloudTrail logs to leverage server-side encryption (SSE) and AWS KMS customer-created master keys (CMKs) to further protect CloudTrail logs.
Configuring CloudTrail to use SSE-KMS provides additional confidentiality controls on log data because a given user must have S3 read permission on the corresponding log bucket and must be granted decrypt permission by the CMK policy.
Perform the following to configure CloudTrail to use SSE-KMS:
- Open the CloudTrail console at CloudTrail
- Choose Trails, select the trail to update, by clicking Edit button in
- In the
Log file SSE-KMS encryption, choose
Customer managed AWS KMS key, select an existing CMK from the KMS key Id drop-down menu
- Note: Ensure the CMK is located in the same region as the S3 bucket
- Note: You will need to apply a KMS Key policy on the selected CMK in order for CloudTrail as a service to encrypt and decrypt log files using the CMK provided.
- To create a key, enter an alias for the key in the
KMS aliasfield. The key is created in the same Region as the bucket.
- Click Save
From Command Line
aws cloudtrail update-trail --name <trail_name> --kms-id <cloudtrail_kms_key> aws kms put-key-policy --key-id <cloudtrail_kms_key> --policy <cloudtrail_kms_key_policy>
steampipe check aws_compliance.control.cis_v140_3_7
This control uses a named query:cloudtrail_trail_logs_encrypted_with_kms_cmk